If the network was split 10 blocks ago then I should see that those 10 blocks took twice as long to create as expected.
This would be the case for a network split where one of the parts has roughly half the hashpower. An even split cannot be expected or relied upon. Block chain reorganizations as a result of network reconnections are likely to be complex events and I think that simple rules for coping with them yield the least unpleasant surprises.
A better metric for inferring an attack would be to estimate the implied aggregate hashpower. If a longer blockchain arrives that invalidates the last 10 blocks and the generation rate has been normal then one could reasonably infer that the aggregate hashpower has doubled and that there is cause for concern.
A reorganization which contains double spends would certainly be suspicious.
I would not recommend inferring anything from timestamps, the originating miner's identity or transaction amounts/numbers/sizes. Such rules would contain arbitrary hard-to-justify "magic numbers", be difficult to test, have complex failure modes and a large security perimiter.
And maybe see if it would be practical to have a checkpoint lock-in rule of something like "auto-checkpoint any AAA-rated block once it is 4-deep in the best chain".
What should be done if a new chain arrives which invalidates an AAA rated block at depth 4 but now the new chain has incoming AAA ratings. The added complexity of sorting out conflicting ratings will have lots of nasty edge cases and be hard to test.
ByteCoin